r17256: fix 2 crash bugs, which are introduced by making parameters

r17256: fix 2 crash bugs, which are introduced by making parameters
ref pointers!

I'm sure there're more places and more care is needed when idl files
are changed. Hopefully testing against windows in the build farm
find such bugs in future...

Why is in the client library this no more possible:

NTSTATUS foo([in,out,ref] uint8 *foo);

and then just

r.in.foo = &foo;
status = dcerpc_foo(p, mem_ctx, &r);

and r.out.foo will set to r.in.foo via pidl magic,
that worked some time ago...

metze
(This used to be commit d8952f00c77ba59e0806b0de802ac28ac977779c)